Skip to main content
Mallory
Back to malware
MalwareUsed by 2 actorsExploits 2 CVEs

EternalSynergy

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES
CVE-2017-0143Windows SMBv1 Remote Code Execution VulnerabilityExploited in the wild

CVE-2017-0143 Vulnerable Products: Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 Associated Malware: Multiple using the EternalSynergy and EternalBlue Exploit Kit Mitigation: Update affected Microsoft products with the latest security patches | CVE-2017-0143 Vulnerable Products: Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 Associated Malware: Multiple using the EternalSynergy and EternalBlue Exploit Kit | CVE-2017-0143 ... Associated Malware: Multiple using the EternalSynergy and EternalBlue Exploit Kit

via cisa advisoriescisa.gov
CVE-2017-0146EternalChampion (Race Condition in SMBv1)

The three exploits are EternalChampion, EternalRomance, and EternalSynergy... CVE-2017-0143... Exploited by EternalRomance EternalSynergy; CVE-2017-0146... Exploited by EternalChampion EternalSynergy.

via bleeping computerbleepingcomputer.com
THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Equation Group

Symantec discovered that as early as March 2016, the Chinese hackers were using tweaked versions of two N.S.A. tools, called Eternal Synergy and Double Pulsar, in their attacks.

via new york timesnytimes.com
APT3

Symantec discovered that as early as March 2016, the Chinese hackers were using tweaked versions of two N.S.A. tools, called Eternal Synergy and Double Pulsar, in their attacks.

via new york timesnytimes.com
MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique
T1078Valid AccountsEvidence1

"Instead of going for shellcode execution, it overwrites the SMB connection session structures to gain Admin/SYSTEM session," Dillon says.

Persistence

1 technique
T1078Valid AccountsEvidence1

"Instead of going for shellcode execution, it overwrites the SMB connection session structures to gain Admin/SYSTEM session," Dillon says.

T1068Exploitation for Privilege EscalationEvidence1

Sean Dillon ... modified the source code for some of these lesser-known exploits so they would be able to work and run SYSTEM-level code on a wide variety of Windows OS versions.

T1078Valid AccountsEvidence1

"Instead of going for shellcode execution, it overwrites the SMB connection session structures to gain Admin/SYSTEM session," Dillon says.

Stealth

1 technique
T1078Valid AccountsEvidence1

"Instead of going for shellcode execution, it overwrites the SMB connection session structures to gain Admin/SYSTEM session," Dillon says.

Lateral Movement

2 techniques
T1021.002SMB/Windows Admin SharesEvidence1

"The [Metasploit Framework] module is leaner ... and has Metasploit's psexec DCERPC implementation bolted onto it."

T1210Exploitation of Remote ServicesEvidence1

Dillon has crafted his modified exploits to take advantage of the following vulnerabilities: CVE-2017-0143 ... EternalRomance EternalSynergy; CVE-2017-0146 ... EternalChampion EternalSynergy.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.